Extracted

Extracted

• • Target

    20557d8b534b624b67bc6c659519d1e2.exe

  • Size

    128KB

  • MD5

    20557d8b534b624b67bc6c659519d1e2

  • SHA1

    721fe4138bf30bb457be01de4fa02effe891db09

  • SHA256

    633b04aa2a794fab5b0e23cb77b1d7a2bc2d69b1f2ec258b02317060d5731681

  • SHA512

    df630b5b5fde0f6d50e17b5689b13a5c83cd08a6b5e78ced65519bfa976a61463ed6b640b6976ac266b35307cb0a7d44dc4637509e71c5bb984bcc736bb3c83f

  • SSDEEP

    768:AggEakQhT9VmoVK/bHUyhDWIKT5Ydf9QuDdwzXik7RNi3CVL:takQhTjT4/b1hDWSUFDTlNpl

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2

• • Target

    25367c955449f48ffc7fd421f8a5f822.exe

  • Size

    987KB

  • MD5

    25367c955449f48ffc7fd421f8a5f822

  • SHA1

    ea39dd8a123d8ffa664e2d91f8f27dfa27f8351b

  • SHA256

    29cd7bf1c70867fc4c7b751e86dcc2d5543b23d92284c8421c829e33ca1589bf

  • SHA512

    b928a8b8bf1207137b9d1f22ae6848fcaeccffdc8c0f0493250761265a4074a511429dd2599ee6a00e867ca1c78df79c25b33c840fda9df32fea1aefdc51b115

  • SSDEEP

    12288:zkgmEQG1G/tf4LOL9FCgppwTz0v/rqQ9ABdMZmJdhIy1VqloXU/KM01EnFrVYlxd:FshEA9udx5u/nFuaakm

  Score

  3^/10
  behavioral3behavioral4

• • Target

    5119c03df1becd83ce7de22565c5fc4d.exe

  • Size

    758KB

  • MD5

    5119c03df1becd83ce7de22565c5fc4d

  • SHA1

    66bbd656f3476d4fee3c430724b1392a1bca92ac

  • SHA256

    fd4226a0d754290aa133ea1a8606846290cac4ec317a8622072d38fca80e8bbe

  • SHA512

    903c69e54df8f8f0685e1988bdaa416e210d4b75e1c0be384b38b9c6dbe647823d85ff5d55a3e2b754017d0aa61536d64959fd47e2a01a3237712ad08135ae65

  • SSDEEP

    12288:sVRQIcb2Cx71529M9tKZ424z8Q/meusGyi2QNixRFMESrROrQza5KtbGIQrOMRCV:ORtcb2Cxp52GtW4hYQ/PpGN2TXO88z30

  Score

  10^/10

  agentteslazgratcollectionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral5behavioral6

• • Target

    5434c5c18f21ddfd15d423d6670b2f98.exe

  • Size

    821KB

  • MD5

    5434c5c18f21ddfd15d423d6670b2f98

  • SHA1

    9ce9670083156ce596cee409224018b0a9ec7719

  • SHA256

    af37f62de78aea952f3f7599d373de0ae8bd283f100b1ba67c78bd6edae45ebf

  • SHA512

    abcd5cecaa559829966d86489345b8402217334c34b3568615c12972c40a8f31e36244dd77fecce528778437667b28a54492a0e270daf5b843334bb2162c4856

  • SSDEEP

    12288:Hb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hOo6Bwy71XLimnqdx:eeSHhYRRxOVGcxJBdb1zyduWqn

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    6631a01942a28fc0507a84c854310df8.exe

  • Size

    1.4MB

  • MD5

    6631a01942a28fc0507a84c854310df8

  • SHA1

    fc2075746a83511aa2e01409b4e8f9420af88625

  • SHA256

    ae711943280a10e5296a2cf63302dbf4cfbec2cd1969346a9ced66085459f22c

  • SHA512

    da9c001d355b493f9fe258f145d60afa35f3696859909e58069395f47fa1bcfa48e631e73cc235672518b2ae1c863ec8632e63a8fdc4ac9281debef8623ab9fa

  • SSDEEP

    24576:sdAKF3zI//5CLMIlAXRZNqqk84BavP6bDK3k9mLX6f1XdshwMtBMeP4V56MoUi0V:s1F3iYmXRZNqqk84BavP6bDK3k9yX6f7

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral10behavioral9

• • Target

    7992c95955b88441a5ab498bc0364f79.exe

  • Size

    10.7MB

  • MD5

    7992c95955b88441a5ab498bc0364f79

  • SHA1

    c3c9a322ecd8d73d4837dbecb021ced856b9abce

  • SHA256

    a5a50622347916cb03000c2ed2b704e43fd0f0768de9debb35c4b05092198af0

  • SHA512

    7e41d2f15fda7277c0af953be170cd7a4cbf70e42126f51394a04fdff7186b63b421e46862f52d077c719e98f7f50837e5c86596dff68111a9b7ec9844ff1eb2

  • SSDEEP

    196608:2f/vKjlpzQDjSRj92hctqRs4e0ValMnOEVyYFvNANoo3i7oiWL9GYttgHEMduyFA:2f/4lpzQD+RmG4eocMnOYojiWhGOgHEJ

  Score

  5^/10

  linkpdf

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral11behavioral12

• • Target

    8452fe515826ab6f43eff16918a40e32.exe

  • Size

    22.0MB

  • MD5

    8452fe515826ab6f43eff16918a40e32

  • SHA1

    64859677fd830793f787fa87c7b29f75883da5cd

  • SHA256

    49d03705739faacb94c8025aaa432597d309fe96026c97ea4f0412bbf09f7a2e

  • SHA512

    6429fa27c63290a777ab6836e7e97b552afdf396a505876fef068929af3da40be01eb505809e4e5bcbb8421ee401439e14a345854b6a17b8ffa8f43375728994

  • SSDEEP

    393216:KOTMIRuiduUzRK3oMS6smRo6SxIM/L/JUH6eBkpH1ed/cViEZs1e4Vj5NnExjuwM:Fg1Oo4WsmRorIMbJUHmpVPiE29XnExjg

  Score

  7^/10

  spywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral13behavioral14

• • Target

    9262fc6203bfd7d41fa45e2976e60ad6.exe

  • Size

    655KB

  • MD5

    9262fc6203bfd7d41fa45e2976e60ad6

  • SHA1

    80cc1a1a6ab1cb24dce21d545acd460dabf4b727

  • SHA256

    07bd93e14158db7e9f13e9cb08413887cf0435e715d3e5bbce8328a37df68e76

  • SHA512

    977965ca3893258c8117e79a8175ddbeb739006e675a091c51c1c4b28354d33c2cec9766d0d2f3e72e0d3b13b063c535c89b08dd850f4b7582ed6a4b34e42d05

  • SSDEEP

    12288:0Pkgdm64AHSTuWOq+/zQaQDgVqyO/JrefRV8x2+ZTz4i61CnNt127oW+59WSfIVZ:CdnbyTuWgb6TZ/JrefR

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral15behavioral16